1,390 reputation
513
bio website
location
age
visits member for 3 years, 3 months
seen Aug 18 at 23:20

Aug
11
comment Properties of PRNG / Hashes
Sorry for the confusion, let me try again: For a given seed, the PRNG we're discussing recursively evaluates a hash function on its own output. When this recursion count approaches the Collision Resistance of the function, it risks colliding with one of its previous outputs. So our expectation for such a PRNG is that its cycle length will have an upper bound determined by the HF's CR. Looking at NIST SP 800-90, Hash_DRBG uses both counters and recursive HF application, and still places very conservative limits on the allowed output (< 2^48 reqs even for SHA-512)
Aug
10
comment How can I improve a password generation scheme based on a shared secret and URL?
As a point of reference, this guy golubev.com/hashgpu.htm is doing 5.8e9 MD5s per second on an off-the-shelf CPU+GPU box. That might translate into 1.8e9 SHA-1s per second. Better pick a strong password!
Aug
9
comment Properties of PRNG / Hashes
Agreed, 2^80 output blocks under the same key is not worth losing sleep over. But why would you even do it that way when the CTR-mode PRNG is no more expensive? On NIST, I read them saying (in their 2007 request for SHA-3 candidate submissions): "The 160-bit hash value produced by SHA–1 is becoming too small to use for digital signatures, therefore, a 160-bit replacement hash algorithm is not contemplated." This suggests to me that they would frown upon "only" 2^80 collion resistance in a new design. They even commissioned a function with a 512-bit output size too.
Aug
7
comment Why isn't the alternating step generator used more often?
My Google searches turned up a related patent web hit, but the linked web page didn't have 'Gunther' in it. It was in Google's result summary though. I had to view source in order to find it!
Aug
7
revised Why isn't the alternating step generator used more often?
minor exposition
Aug
7
answered Why isn't the alternating step generator used more often?
Aug
7
revised Properties of PRNG / Hashes
Some claims not holding up under scrutiny and withdrawn
Aug
7
comment Properties of PRNG / Hashes
OK, I'll buy that about the cycle length.
Aug
6
answered Where do I securely store the key for a system where the source is visible?
Aug
6
comment Properties of PRNG / Hashes
They certainly don't impose the memory overhead of a Mersenne Twister.
Aug
6
comment Is the logic for how the enigma machine worked documented somewhere?
Perhaps this is what you want: Simulator "A recurring theme in my Inbox is people asking for the enigma wheel wiring so that they can write their own simulator. To save repetition, this web page contains the information you will need if you want to build yourself a simulator."
Aug
6
comment Properties of PRNG / Hashes
@D.W. Well I didn't mean to say that 2^80 was an imminent security problem - but there are certainly many users who wouldn't accept it in a new design either, e.g., NIST. Also -- I didn't believe that paper either. So I tested it with exhaustive and Monte Carlo analysis on much smaller (and likely much more ideal) random functions. My results suggested that, if anything, the effect was understated a bit. Here's some links to the ensuing discussion (including some source): bit.ly/oOe8tX bit.ly/rn3my3 My feeling about 2^64 wasn't based on the analytic collisions...just 160/2.5.
Aug
6
awarded  Commentator
Aug
6
comment Properties of PRNG / Hashes
@Paŭlo I don't get your 'by this argument...'. A string comparison algorithm can be easily demonstrated to be O(N) with just a few small observations, whereas a 512-bit counter will simply not ever roll over to needing a second block. Only in practice, not theory, of course. :-)
Aug
6
comment What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Sure, eprint.iacr.org/2006/254 and eprint.iacr.org/2010/285 for example. What's most interesting though is how the attitudes towards SAT seems to have changed in just 4 years. From (literally) "We expect SAT solvers to find new applications as a validation and testing tool of practicing cryptanalysts" to "We found preimages for some reduced versions and showed that full function is secure against the presented attack."
Aug
5
answered What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Aug
5
comment How can SSL secure a two-way communication with only one key-pair?
Netscape developed SSL 2.0 which is now all-but-abandoned. SSL 3.0 was developed and Netscape evaporated and handed stewardship of the protocol spec to the IETF who promptly renamed it TLS 1.0 (to fit their nomenclature). SSL 3.0 and TLS 1.0 are nearly identical. Nobody (give or take) uses TLS 1.1 or 1.2. The use of Diffie-Hellman to agree upon an ephemeral key is an option that client and server may choose to agree upon, but it's totally an option and not preferred by most sites due to the computational expense.
Aug
4
awarded  Editor
Aug
4
revised Reverse engineering a hash?
added 414 characters in body
Aug
4
comment Properties of PRNG / Hashes
Yeah, if you don't pay the incremental costs before the entire universe burns out, I consider it O(1). Guess I'm a coder, not a mathematician. :-)